CVE-2026-25759

HIGH

8.7

Beschreibung

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.

CVE Details

CVSS v3.1 Bewertung8.7

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionREQUIRED

Veroffentlicht2/11/2026

Zuletzt geandert2/18/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

statamic:statamic

Schwachen (CWE)

CWE-79

Referenzen

https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6(security-advisories@github.com)

https://github.com/statamic/cms/releases/tag/v6.2.3(security-advisories@github.com)

https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8(security-advisories@github.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.